740a741,752
> # Submitted by Adam Baldwin - Reference http://evilpacket.net
> # Identifies Symantec ManHunt or SNS console (qsp proxy)
> # 32 bytes of data sent when a connection is made
> # 01 01 00 08 1C EE 01 00 00 00 00 00 00 00 00 00
> # 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> if (r == '\x01\x01\x00\x08\x1c\xee\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00')
> {
>   register_service(port: port, proto: 'qsp-proxy');
>   security_note(port: port, data: "A Symantec ManHunt / SNS console (QSP Proxy) seems to be running on this port");
>   exit(0);
> }
>